M-02·
`block.timestamp` use in dex swap deadlines may cause poor trading
TL;DR
In the PositionInteractionFacet.sol contract, when executing DEX swaps, the deadline parameter is set to block.timestamp + 30 minutes:
Severity
MEDIUM
Method
MManual review
CAT.
02Section · Severity
Severity
Impact: Medium
Likelihood: Medium
03Section · Description
Description
In the PositionInteractionFacet.sol contract, when executing DEX swaps, the deadline parameter is set to block.timestamp + 30 minutes:
solidity
IV3SwapRouter.ExactOutputSingleParams memory params = IV3SwapRouter.ExactOutputSingleParams({tokenIn: assetIn,tokenOut: assetOut,fee: dex.dexFee,recipient: address(this),deadline: block.timestamp + 30 minutes, // Unnecessary bufferamountOut: amountOut,amountInMaximum: amountInMaximum,sqrtPriceLimitX96: sqrtPriceLimitX96});
This implementation is problematic for several reasons:
- The
30-minutebuffer is unnecessary since the transaction will be executed at the currentblock.timestampanyway. - This extended deadline window allows malicious MEV bots to potentially withhold the transaction and execute it at a less optimal time.
- This implementation doesn't provide any real protection against transaction delays since the actual execution time is determined by the network's block production.
04Section · Recommendations
Recommendations
Replace the current deadline implementation with the user input deadline.
05Section · Report provenance
Report provenance
Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.